Wordfence Argus

يحدث تجاوز لسعة المخزن المؤقت المستند إلى heap في الدالة `unc decoder mixed interleave::processTile()`. يتم تحفيز هذه المشكلة عند معالجة ملف HEIF بمكونات chroma ذات أعماق بت غير متساوية، مثل Cb بدقة 16 بت و Cr بدقة 8 بت. يسمح هذا للمهاجم بإجراء عمليات كتابة خارج الحدود تتجاوز مستوى Cr، مما قد يؤدي إلى تنفيذ رمز برمجي عشوائي في أنابيب معالجة الصور.

يحدث خطأ مرجع كائن مباشر غير آمن بسبب فقدان التحقق من مفتاح يتحكم فيه المستخدم. يمكن للمهاجمين غير المصرح لهم حذف مسودات محفوظة عشوائية لمستخدمين آخرين والاستيلاء على معرفات تلك المسودات عن طريق استبدالها بإرسالات نماذج يتحكم فيها المهاجم. يتطلب هذا الاستغلال أن يحصل المهاجم على `draft id` الخاص بالضحية، والذي يمكن جمعه من رابط "المتابعة لاحقاً" المشترك. يتم تجاوز فحص nonce لأن nonce متاح علناً لأي زائر غير مصرح له يقوم بتحميل صفحة النموذج. يتم تحفيز هذه المشكلة عبر المعلمة `previous draft id`.

يوجد ثغرة حقن كائنات PHP (PHP Object Injection) غير مصرح بها ناتجة عن إلغاء تسلسل محتوى قاعدة بيانات غير موثوق به داخل الدالة `unserializeTest()` في الفئة `DUPX UpdateEngine` أثناء عملية الهجرة. يمكن للمهاجمين تخزين كائن متسلسل في محتوى الموقع العام، والذي يتم معالجته لاحقاً عندما يقوم المسؤول بإنشاء حزمة وتنفيذ عملية هجرة أو استيراد تتضمن البحث والاستبدال في قاعدة البيانات. في النسخة المجانية، تسمح سلسلة POP الخاصة بـ Requests 1.7 بتنفيذ أوامر نظام التشغيل مباشرة عبر استدعاءات يحددها المهاجم. أما في نسخة Pro، فيسمح gadget المدمر `IndexList` بحذف ملف محدد إذا كان الدليل قابلاً للكتابة بواسطة عملية PHP الخاصة بالمثبت؛ على سبيل المثال، حذف ملف `wp-config.php` قد يؤدي إلى تفعيل معالج الإعداد، مما قد يؤدي إلى السيطرة على الموقع وتنفيذ التعليمات البرمجية إذا قام المهاجم بتوفير قاعدة بيانات يتحكم بها.

An authorization bypass exists due to improper verification before dispatching a WordPress action hook. The issue occurs when the hook name is derived from an attacker-supplied form-field value via the notification `email message` [field] placeholder and the `{action hook,...}` dynamic-data token. This allows unauthenticated attackers to invoke arbitrary WordPress action hooks, which can lead to permanent destruction of site content, such as the deletion of trashed posts, pages, and comments through the `wp scheduled delete` action. Additionally, it can cause denial of service via `wp maybe auto update` or enable privileged writes if vulnerable third-party handlers are present. The same pipeline allows for a blind arbitrary user or post-meta read, although the result is only delivered to the site owner. Exploitation requires a published Avada form with AJAX submission and a notification template containing an `[all fields]` or explicit `[field]` placeholder.

Stored Cross-Site Scripting occurs due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's `save popup content` AJAX action. Unauthenticated attackers can inject arbitrary web scripts via the `content` parameter into a published Gutenberg popup. These scripts execute when a user visits a page where the popup is configured to display. This issue requires a valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display.

A heap-based buffer overflow exists in the JPEG 2000 output adapter within the `base/sjpx openjpeg.c` file. The issue occurs when processing a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. In such cases, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth. This results in memory corruption of internal chunk-allocator metadata, which can lead to a process crash or remote code execution.

Unauthenticated attackers can achieve Remote Code Execution on the server due to insufficient protection in the `is safe widget instance()` function. The issue arises because PHP magic methods are triggered during pre-parse, and the `enable rendering widget copied()` function can forge a valid `wp hash` integrity attribute before the `unserialize()` function is reached. This allows for PHP Object Injection. The flaw is exploitable when comments are enabled and visible on events, as the V2 single-event template processes `do blocks()` over buffered comment HTML. An unauthenticated commenter can use a moderation-hash URL to view their pending comment immediately, delivering injected block markup to the vulnerable code path before moderation occurs.

Unauthenticated attackers can achieve Remote Code Execution on the server through the `parse array()` function in `Element Classes::parse array()`. The issue stems from insufficient validation of the widget `classes` map, which allows a plain-array payload to bypass the `is safe widget instance()` object check and reach a callable-invocation sink. This attack chain is triggered when `do blocks()` processes the single-event HTML including the comment area. Successful exploitation requires that the site has comments enabled on `tribe events` posts and that a comment containing a crafted `wp:legacy-widget` block has been submitted.

The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the `tutor save withdraw account` AJAX handler via the `withdraw method field` parameter. The handler lacks proper capability or role checks, relying only on a nonce. The issue occurs because `esc sql()` is misapplied to values stored via `update user meta()`, causing a serialization length desynchronization where the serialized string length is 65 bytes larger than the actual content. This allows `unserialize()` to over-read into attacker-controlled POST keys and inject an arbitrary serialized object stream. Attackers with subscriber-level access or higher can trigger the `GuzzleHttpCookieFileCookieJar` POP chain (Property-Oriented Programming) via the `spl autoload register` loader in `TUTORRestAPI`, enabling them to write arbitrary content to a file on the server. This can be exploited by unauthenticated users if user registration and the monetization feature are enabled.

An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the `GFAsyncUpload::upload()` function. Specifically, a cryptographic domain-confusion flaw occurs because `wp hash()` is reused without context separation for both public form state and chunk-continuation authentication, allowing attackers to reuse a legitimate URL hash to authenticate malicious upload requests. Unauthenticated attackers can exploit this when a public form has a File Upload field with Multiple Files enabled by uploading a PNG or PDF polyglot—a file that is valid in two different formats—to a filename of their choice, such as `.php` or `.html`, in the temporary upload directory. This can lead to remote code execution on systems using NGINX or other web servers that do not respect `.htaccess` files. On servers where PHP execution is blocked, such as Apache, uploading an HTML file can result in stored same-origin cross-site scripting (XSS), which occurs when a malicious script is permanently stored on the server and executed in the victim's browser.

An authentication bypass exists in the Hub Single Sign-On (SSO) flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a protocol design failure where the signer and verifier disagree on the message structure—between two unauthenticated AJAX endpoints: 'wdpsso step1' and 'wdpsso step2'. In 'wdpsso step1', the system signs a concatenation of `token`, `state`, `redirect`, and `domain` without delimiters. However, 'wdpsso step2' verifies a concatenation that omits the `domain` field. An attacker can use 'wdpsso step1' as a signing oracle by providing an empty `redirect` value to obtain a valid HMAC for the combined `token`, `state`, and `domain`. By replaying this HMAC to 'wdpsso step2' and moving the `domain` value into the `redirect` field, the resulting byte string remains identical, causing the verification to succeed. This allows an unauthenticated attacker to obtain an authenticated administrator session if Hub SSO is enabled and mapped to an administrator. If the WordPress theme or plugin editor is accessible, this can lead to full site takeover and remote code execution via PHP modification.

An unauthenticated attacker can achieve remote code execution and complete site compromise by writing attacker-controlled PHP files to the server. This is possible through a six-stage chain of weaknesses involving authorization, input validation, trust boundaries, privileged behavior, and file handling across the theme and its required plugin. Successful exploitation requires both the theme and the plugin to be installed and active, as well as the presence of certain administrator-authored content. Over 1 million sites are potentially affected.